CVE-2026-87736: 
Linux Debian vulnerability analysis and mitigation

CVE-2026-87736 is an out-of-bounds read vulnerability in the mirage-crypto-ec package for OCaml, triggered when processing compressed elliptic curve (EC) public keys. It affects all versions of mirage-crypto-ec before 2.3.0. The vulnerability was published on September 9, 2026, with a patch available in version 2.3.0. It carries a CVSS v3.1 base score of 4.3 (Medium) (GitHub Advisory).

The root cause is an out-of-bounds read (CWE-125) in the EC public key parsing logic of mirage-crypto-ec, specifically when handling compressed point representations. An authenticated, network-adjacent attacker can supply a malformed compressed EC public key that causes the library to read memory beyond the intended buffer boundary. No special user interaction is required, and attack complexity is low, though the attacker must be authenticated. No public technical write-up or proof-of-concept code has been identified (GitHub Advisory).

Successful exploitation can cause the affected OCaml application to crash, resulting in a denial-of-service condition. The CVSS scoring reflects a low availability impact with no confidentiality or integrity impact, meaning data exfiltration or modification is not a direct consequence. The scope is limited to the vulnerable component itself, with no evidence of lateral movement potential (GitHub Advisory).

There is no known public proof-of-concept exploit and no evidence of active in-the-wild exploitation as of the time of disclosure. The CVE status is listed as "Deferred" and NVD SSVC assessment confirms exploitation is "none" at this time. The EPSS score is approximately 0.212% (12th percentile), indicating a low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog (GitHub Advisory).

The primary remediation is to upgrade the mirage-crypto-ec package to version 2.3.0 or later, which contains the fix for this vulnerability. If immediate patching is not feasible, operators should restrict network access to services that use this library and enforce authentication controls to limit exposure to trusted users only. No additional workarounds have been published (GitHub Advisory).